Affected Systems
OpenWrt versions prior to 24.10.8 (24.10 branch) and 25.12.5 (25.12 branch). The vulnerability affects the odhcpd DHCPv6 service running as root on all devices with DHCPv6 enabled by default. Embedded hardware typically lacks stack canaries and ASLR, increasing exploitation likelihood.
Exploitation Status
Public proof-of-concept Python exploit code is available for both documented overflow paths. No active exploitation in the wild reported as of July 28, 2026. Not listed in CISA KEV catalog as of 2026.07.27.
Business Impact
Unauthenticated attackers with network access to UDP port 547 can send crafted DHCPv6 REQUEST packets to trigger stack buffer overflow in odhcpd, which runs as root. Successful exploitation grants full router control. The CVSS 3.1 score is 9.8. Embedded devices commonly lack exploit mitigations (stack canaries, ASLR), making code execution highly feasible. Additional vulnerabilities in the same release include HTTP request smuggling in uhttpd, stored XSS via DHCPv6 hostname injection (CVE-2026-62948), and authenticated path traversal in cgi-io (CVE-2026-62947). OpenWrt 24.10 reaches end-of-life in September 2026.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade OpenWrt devices to version 24.10.8 (24.10 branch) or 25.12.5 (25.12 branch) via the OpenWrt Firmware Selector.
- Verify odhcpd service has been updated to commit beyond e432dd6; check installed package versions separately if not using official firmware images.
- If immediate patching is not possible, restrict network access to UDP port 547 (DHCPv6) using firewall rules to trusted sources only.
- Plan migration from OpenWrt 24.10 to 25.12 series before end-of-life in September 2026.
- Monitor for unusual DHCPv6 traffic patterns or odhcpd service crashes; review logs for unexpected DHCPv6 REQUEST packets with oversized IA options.